Global maritime industry "ripe for hacking"

The European Union’s Emissions Trading System (EU ETS) was extended to cover emissions from shipping as of 1^st January 2024.

The EU ETS is limited by a 'cap' on the number of emission allowances. Within the cap, companies receive or buy emission allowances, which they can trade as needed. The cap decreases every year, ensuring that total emissions fall.

Each allowance gives the holder the right to emit:

One tonne of carbon dioxide (CO2), or;
The equivalent amount of other powerful greenhouse gases, nitrous oxide (N2O) and perfluorocarbons (PFCs).
The price of one ton of CO2 allowance under the EU ETS has fluctuated between EUR 60 and almost EUR 100 in the past two years. The total cost of emissions will vary based on the cost of the allowance at the time of purchase, the vessel’s emissions profile and the total volume of voyages performed within the EU ETS area. The below is for illustration purposes:
~A 30.000 GT passenger ship has total emissions of 20.000 tonnes in a reporting year, of which 9.000 are within the EU, 7.000 at berth within the EU and 4.000 are between the EU and an outside port. The average price of the allowance is EUR 75 per tonne. The total cost would be as follows:
~~9.000 * EUR 75 = EUR 675.000
~~7.000 * EUR 75 = EUR 525.000
~~4.000 * EUR 75 * 50% = EUR 150.000
~~Total = EUR 1.350.000 (of which 40% is payable in 2024)
For 2024, a 60% rebate is admitted to the vessels involved. However, this is reduced to 30% in 2025, before payment is due for 100% with effect from 2026.
Emissions reporting is done for each individual ship, where the ship submits their data to a verifier (such as a class society) which in turns allows the shipowner to issue a verified company emissions report. This report is then submitted to the administering authority, and it is this data that informs what emission allowances need to be surrendered to the authority.
The sanctions for non- compliance are severe, and in the case of a ship that has failed to comply with the monitoring and reporting obligations for two or more consecutive reporting periods, and where other enforcement measures have failed to ensure compliance, the competent authority of an EEA port of entry may issue an expulsion order. Where such a ship flies the flag of an EEA country and enters or is found in one of its ports, the country concerned will, after giving the opportunity to the company concerned to submit its observations, detain the ship until the company fulfils its monitoring and reporting obligations.
Per the EU’s Implementing Regulation, it is the Shipowner who remains ultimately responsible for complying with the EU ETS system.

There are a number of great resources on the regulatory and practical aspects of the system – none better than the EU’s own:

‍https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02003L0087-20230605

‍https://climate.ec.europa.eu/eu-action/transport/reducing-emissions-shipping-sector_en

‍https://climate.ec.europa.eu/eu-action/eu-emissions-trading-system-eu-ets/what-eu-ets_en‍

The maritime industry often has high value cargo ships with legacy systems, bad awareness, poor processes, and seaports suffering from the same problems, making it an industry “ripe for hacking”, according to Tamlin Magee, writing last month in TechWorld.

Although more than 80% of global trade by volume is transported from region to region by ships, and 10.3bn tons in total moving between seaports around the world globally in 2016, incident after incident has demonstrated how much the industry is vulnerable to cyber-attack, said Magee.

In 2015 Kaspersky Labs called shipping “easy meat” for hackers, and reported on a sequence of significant hacks, ranging from a drilling rig that was hacked and tilted from its site in South Korea towards South America – as long ago as 2010, to a 2012 incident when a criminal gang hacked into the systems of the Australian Customers and Border Protection Service agency, permitting them to be one step ahead of authorities when they placed containers under suspicion.

Maritime security company CyberKeel had noted that ships were switching off their navigation systems when travelling through waters where armed pirates are known to operate – sometimes faking the data to make the ships appear they were elsewhere. A scheme in the Belgian port town of Antwerp saw criminals gain access to systems that controlled the movement of containers to smuggle cocaine, heroin and guns.

In 2017, a cargo ship travelling from Cyprus to Djibouti lost control of its navigation system for 10 hours – preventing a captain from manoeuvring and with the intention of steering it into territory where it could be easily boarded by pirates and robbed, said Safety At Sea, which heard from a source that the “IT system of the vessel was completely hacked”.

In October last year Ken Munro at PenTestPartners demonstrated drew a comparison with industrial control systems – noting that, although the network protocols and security systems were virtually non-existent when they were created, this didn’t matter so much as long as the endpoint and communications security was robust. He called ships “complex industrial controls, but floating”.

https://www.techworld.com/security/can you hack ship global maritime industry ripe for hacking 3674517/

Global maritime industry "ripe for hacking"

The European Union’s Emissions Trading System (EU ETS) was extended to cover emissions from shipping as of 1st January 2024.

The European Union’s Emissions Trading System (EU ETS) was extended to cover emissions from shipping as of 1^st January 2024.